In the prior art, an averaging/thresholding method has been applied for learning the behavior trends of a network. Basically, this method observes the traffic in a network segment over a period of time, for example a month, in order to determine an average or norm of the behavior over time. For example, the average bandwidth utilization in a network segment backbone may be represented by an interval [x, y], where x is the lower threshold of utilization and y is the upper threshold. During a period of one month, the bandwidth utilization may for instance fall within an interval [25, 40], with only a few stray values falling outside the interval, where 25 is the lower threshold, and 40 is the upper threshold.
Commercial tools that implement the averaging method generally record bandwidth utilization data for some period of time and then use a statistical algorithm to calculate the norm. A current value of bandwidth utilization is then compared with the calculated norm. If the current value is outside the norm, an alarm is issued to warn the network administrator of the discrepancy.
The averaging/thresholding method can be extended to find norms for traffic occurring within multiple network segments, in trunks that connect segments, and between individual nodes in a network. An example of a commercial tool that uses the averaging/thresholding method is the HP Network Advisor, sold by Hewlett Packard Company, 4 Choke Cherry Road, Rockville, Md. 20850.
The averaging/thresholding method is useful for setting watches on network segments and for alerting the network administrator when the current traffic on a particular network segment exceeds a threshold. However, if the network administrator needs to understand the overall behavior patterns of the network, the averaging/thresholding method does not suffice. A method that predicts network behavior would be extremely helpful in providing the administrator more opportunity and time to intervene when the network appears to be moving toward a problematic state. With such a method, the administrator would be able to intervene before the problematic state occurred.